pi-lens 4.1.2 → 4.1.4

package/dist/clients/rust-client.js

@@ -63,4 +63,35 @@ export class RustClient {
     isRustFile(filePath) {
         return path.extname(filePath).toLowerCase() === ".rs";
     }
+    /** Forget the memoized cargo path and latched availability verdict — #2455. */
+    resetAvailability() {
+        this.availability.reset();
+    }
+}
+/**
+ * The one `RustClient` this process owns (#2455 fix round 4, F2).
+ *
+ * Same shape as `go-client.ts`'s `goClient`, and the same round-2 defect: the
+ * runner (`dispatch/runners/rust-clippy.ts`) and `bootstrap.ts` each built
+ * their own instance, so `resetRustAvailability` re-armed one latch while
+ * `handleSessionStart`'s "Active tools" line read the other's never-expiring
+ * probe-class "missing" verdict. One instance, in the module that owns the
+ * class; `tests/clients/toolchain-client-singleton.test.ts` holds the line.
+ */
+export const rustClient = new RustClient();
+/**
+ * Forget `rustClient`'s memoized cargo path and latched availability verdict —
+ * #2455. Same #1496/#1535 shape as `resetZizmorTokenAvailability`; wired into
+ * `handleSessionStart` beside it (`clients/runtime-session.ts`) so a Rust
+ * toolchain installed mid-process is observed by the next session instead of
+ * staying "missing" for the rest of the process's life.
+ *
+ * This module — not `rust-clippy.ts` — because the reset must sit beside the
+ * single instance it clears (#2455 fix round 4, F2). `rust-clippy.ts`'s
+ * `clippyAvailabilityByCargo` is a separate, already-covered latch: it rides
+ * `createCwdCachedProbe`'s shared `availabilityGeneration` counter (see
+ * `runner-helpers.ts`'s `resetDispatchAvailabilityState`), not this reset.
+ */
+export function resetRustAvailability() {
+    rustClient.resetAvailability();
 }

package/dist/clients/safe-spawn.js

@@ -16,11 +16,13 @@
 import { spawn, spawnSync, } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { BoundedFifoMap } from "./bounded-cache.js";
 import { logLatency } from "./latency-logger.js";
 import { recordDegradation } from "./degradation-ledger.js";
 import { logExtension } from "./extension-log.js";
 import { isFullyQualifiedWin32 } from "./path-utils.js";
 import { startSpawnUsageSampler } from "./resource-sampler.js";
+import { compareOrdinal } from "./string-utils.js";
 /** Intent-level spawn failure. `cause` retains the original OS Error/errno. */
 export class SpawnFailureError extends Error {
     kind;
@@ -569,23 +571,21 @@ function resolveWindowsPathEntry(entry, effectiveCwd, env) {
  * cache is also count-bounded with oldest-entry eviction because a long-lived
  * process can encounter unbounded cwd/environment combinations.
  */
-const WINDOWS_COMMAND_CACHE_MAX_ENTRIES = 256;
+export const WINDOWS_COMMAND_CACHE_MAX_ENTRIES = 256;
 const WINDOWS_COMMAND_NEGATIVE_CACHE_TTL_MS = 1000;
-const windowsCommandCache = new Map();
+const windowsCommandCache = new BoundedFifoMap(WINDOWS_COMMAND_CACHE_MAX_ENTRIES);
 /** Reset after session replacement or a successful managed install. */
 export function resetSafeSpawnWindowsCommandCache() {
     windowsCommandCache.clear();
     loggedSpawnClassifications.clear();
 }
 function cacheWindowsCommandResult(key, resolved) {
-    if (windowsCommandCache.size >= WINDOWS_COMMAND_CACHE_MAX_ENTRIES) {
-        // Resolution entries are session-scoped and cheap to recompute. Evict the
-        // oldest insertion first so a long-lived process cannot retain every cwd /
-        // environment it has ever touched.
-        const oldest = windowsCommandCache.keys().next().value;
-        if (oldest !== undefined)
-            windowsCommandCache.delete(oldest);
-    }
+    // Resolution entries are session-scoped and cheap to recompute. The
+    // caller always deletes any stale entry for `key` before reaching here
+    // (see resolveWindowsCommandForEnvironment), so this can only grow the
+    // map; BoundedFifoMap evicts the oldest insertion first once the map
+    // exceeds capacity, so a long-lived process cannot retain every cwd /
+    // environment it has ever touched.
     windowsCommandCache.set(key, { resolved, checkedAt: Date.now() });
 }
 function getPathExts(env) {
@@ -701,7 +701,7 @@ export function resolveWindowsCommandForEnvironment(command, cwd, env) {
         .flatMap(([key, value]) => /^=[A-Za-z]:$/.test(key)
         ? [[key.toLowerCase(), value]]
         : [])
-        .sort(([left], [right]) => left.localeCompare(right));
+        .sort(([left], [right]) => compareOrdinal(left, right));
     // Keep presence separate from value: absent PATHEXT means the Windows
     // default extension list, while PATHEXT="" means no implicit extensions.
     // The per-drive snapshot is equally important: it is provenance for
@@ -792,6 +792,13 @@ function ensureUtf8ConsoleCodePageOnce() {
         spawnSync(cmdExe, ["/d", "/s", "/c", "chcp 65001 >nul 2>&1"], {
             shell: false,
             windowsHide: true,
+            // #1980 population sweep: a synchronous spawn with no timeout parks
+            // the event loop for as long as the child takes, and nothing here
+            // bounds that. `chcp` is normally instant, but this runs before the
+            // FIRST real spawn of the process, which is exactly when a cold or
+            // antivirus-throttled cmd.exe is slowest. Matches the 5s bound every
+            // other synchronous child-process site in this repo already carries.
+            timeout: 5000,
         });
     }
     catch {
@@ -840,6 +847,30 @@ const EXIT_PIPE_IDLE_MAX_WAIT_MS = 2000;
  * - Kills the process on timeout (preventing zombies)
  * - Supports cancellation via AbortSignal
  *
+ * ## Why this bound is NOT `bounded()` — the one documented exception (#2523)
+ *
+ * #2523 slice 2 folded every other "deadline AND abort signal" implementation
+ * in the tree onto `clients/deadline-utils.ts#bounded`. This one stays, and it
+ * is not a copy of the same idea:
+ *
+ * `bounded()` ABANDONS a promise — it stops waiting and lets the work run on
+ * unobserved, which is safe precisely because everything it wraps is in-process
+ * (a dynamic import, an LSP round trip, a `stat`). This function's work is a
+ * CHILD PROCESS, and abandoning one leaks it. So its timer does not settle a
+ * race at all: `timeoutId` sets `timedOut`, then runs `killTree()` — SIGTERM,
+ * an escalation timer, SIGKILL, and on Windows a `taskkill /T` of the whole
+ * tree — and the promise settles only when the child's own `close` arrives (or
+ * the escalation gives up). The result it produces carries the teardown
+ * EVIDENCE (`timeoutTeardown`, #2010): which signal killed it, whether the
+ * tree actually died, how long it took. Replacing that with `bounded()` would
+ * return `undefined` at the deadline and leave a live `vitest`/`gradle` behind
+ * — the orphan class #2504 measured as 59 concurrent spawns starving a turn.
+ *
+ * The rule the exception preserves: a bound that can CANCEL its work must
+ * cancel it. `bounded()` is for work that cannot be cancelled; this is not
+ * that. Anything wrapping THIS function still gets `bounded()` around its own
+ * await if it needs one.
+ *
  * @example
  * const result = await safeSpawnAsync("npm", ["test"], { timeout: 30000 });
  * if (result.error) console.error("Failed:", result.error);
@@ -891,6 +922,8 @@ export async function safeSpawnAsync(command, args, options) {
         let aborted = false;
         let killed = false;
         let outputTruncated = false;
+        let killedForOutputCap = false;
+        let streamingMatch = false;
         // #1651 review: a single boolean the close/error handlers both check
         // AND set, so whichever one decides the outcome first wins outright —
         // the DECISION itself is shape-based (see the `close` handler below),
@@ -937,21 +970,116 @@ export async function safeSpawnAsync(command, args, options) {
             options.maxOutputBytes > 0
             ? Math.floor(options.maxOutputBytes)
             : undefined;
-        const appendOutput = (current, chunk) => {
+        const outputTruncationMarker = "\n...[output truncated]...\n";
+        let retainedHead = [];
+        let retainedTail = [];
+        let retainedTailBytes = 0;
+        let retainedTailLimit = 0;
+        let truncationStream = "stderr";
+        const streamingMatcher = options?.matchWhileStreaming;
+        const streamingCarryBytes = streamingMatcher
+            ? Math.max(0, streamingMatcher.source.length - 1)
+            : 0;
+        const streamingCarry = {
+            stdout: "",
+            stderr: "",
+        };
+        const bytePrefix = (text, bytes) => Buffer.from(text).subarray(0, bytes).toString();
+        const byteSuffix = (text, bytes) => {
+            const buffer = Buffer.from(text);
+            return buffer.subarray(Math.max(0, buffer.byteLength - bytes)).toString();
+        };
+        const appendTail = (part, maxBytes) => {
+            if (maxBytes <= 0)
+                return;
+            retainedTail.push({ stream: part.stream, text: part.text });
+            retainedTailBytes += Buffer.byteLength(part.text);
+            while (retainedTailBytes > maxBytes && retainedTail.length > 0) {
+                const first = retainedTail[0];
+                const excess = retainedTailBytes - maxBytes;
+                const firstBytes = Buffer.byteLength(first.text);
+                if (firstBytes <= excess) {
+                    retainedTail.shift();
+                    retainedTailBytes -= firstBytes;
+                }
+                else {
+                    first.text = byteSuffix(first.text, firstBytes - excess);
+                    retainedTailBytes -= excess;
+                }
+            }
+        };
+        const renderOutput = (stream) => {
+            const head = retainedHead
+                .filter((part) => part.stream === stream)
+                .map((part) => part.text)
+                .join("");
+            const tail = retainedTail
+                .filter((part) => part.stream === stream)
+                .map((part) => part.text)
+                .join("");
+            const marker = stream === truncationStream ? outputTruncationMarker : "";
+            return head + marker + tail;
+        };
+        const refreshRetainedOutputs = () => {
+            stdout = renderOutput("stdout");
+            stderr = renderOutput("stderr");
+        };
+        const appendOutput = (stream, current, chunk) => {
             const text = typeof chunk === "string" ? chunk : chunk.toString();
-            if (maxOutputBytes === undefined)
-                return current + text;
-            const used = Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
-            const remaining = maxOutputBytes - used;
-            if (remaining <= 0) {
-                outputTruncated = true;
-                return current;
+            if (maxOutputBytes === undefined || outputTruncated) {
+                if (maxOutputBytes === undefined)
+                    return current + text;
+                appendTail({ stream, text }, retainedTailLimit);
+                truncationStream = stream;
+                return renderOutput(stream);
             }
+            const used = Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
             const bytes = Buffer.byteLength(text);
-            if (bytes <= remaining)
+            if (used + bytes <= maxOutputBytes)
                 return current + text;
             outputTruncated = true;
-            return current + Buffer.from(text).subarray(0, remaining).toString();
+            truncationStream = stream;
+            const available = Math.max(0, maxOutputBytes - Buffer.byteLength(outputTruncationMarker));
+            const headBytes = Math.floor(available / 2);
+            const tailBytes = available - headBytes;
+            retainedTailLimit = tailBytes;
+            const parts = [
+                { stream: "stdout", text: stdout },
+                { stream: "stderr", text: stderr },
+                { stream, text },
+            ];
+            let headRemaining = headBytes;
+            for (const part of parts) {
+                if (headRemaining <= 0)
+                    break;
+                const kept = bytePrefix(part.text, headRemaining);
+                if (kept)
+                    retainedHead.push({ stream: part.stream, text: kept });
+                headRemaining -= Buffer.byteLength(kept);
+            }
+            let tailRemaining = tailBytes;
+            for (let index = parts.length - 1; index >= 0 && tailRemaining > 0; index--) {
+                const part = parts[index];
+                const kept = byteSuffix(part.text, tailRemaining);
+                if (kept) {
+                    retainedTail.unshift({ stream: part.stream, text: kept });
+                    tailRemaining -= Buffer.byteLength(kept);
+                }
+            }
+            retainedTailBytes = tailBytes - tailRemaining;
+            return renderOutput(stream);
+        };
+        const matchStreamingChunk = (stream, chunk) => {
+            if (streamingMatch || !streamingMatcher)
+                return;
+            const text = typeof chunk === "string" ? chunk : chunk.toString();
+            streamingMatcher.lastIndex = 0;
+            streamingMatch = streamingMatcher.test(streamingCarry[stream] + text);
+            if (streamingCarryBytes > 0) {
+                streamingCarry[stream] = Buffer.from(streamingCarry[stream] + text)
+                    .subarray(-streamingCarryBytes)
+                    .toString();
+            }
         };
         // Spawn the process (non-blocking). Keeping Node's `shell` option false
         // is important on every path here: shell:true concatenates tainted
@@ -1091,6 +1219,12 @@ export async function safeSpawnAsync(command, args, options) {
             }));
             return;
         }
+        // Keep historical open stdin by default. An opted-in payload is written
+        // completely and followed by EOF; input: "" closes stdin immediately.
+        if (options?.input !== undefined) {
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(options.input);
+        }
         if (child.pid && (posixProcessGroup || options?.lifetimeCoupled)) {
             // #2026: POSIX registers unconditionally - detached children no
             // longer receive terminal signals directly, so the lifetime
@@ -1201,11 +1335,17 @@ export async function safeSpawnAsync(command, args, options) {
         };
         abortSignal?.addEventListener("abort", onAbort, { once: true });
         // Output-cap kills are awaited by finalize() below, just like
-        // timeout/abort kills. This keeps a noisy CLI from continuing in the
-        // background after its retained output has been bounded.
+        // timeout/abort kills. An armed, unmatched streaming matcher is the one
+        // exception: retention remains bounded, but the caller's timeout is the
+        // bound while the child gets a chance to emit its rescue line.
         let killPromise;
         const stopForOutputLimit = () => {
-            if (outputTruncated && !killed && !child.killed) {
+            const waitingForStreamingMatch = streamingMatcher !== undefined && !streamingMatch;
+            if (outputTruncated &&
+                !waitingForStreamingMatch &&
+                !killed &&
+                !child.killed) {
+                killedForOutputCap = true;
                 killed = true;
                 killPromise = killTree();
             }
@@ -1214,12 +1354,18 @@ export async function safeSpawnAsync(command, args, options) {
         child.stdout?.setEncoding("utf-8");
         child.stderr?.setEncoding("utf-8");
         child.stdout?.on("data", (data) => {
-            stdout = appendOutput(stdout, data);
+            matchStreamingChunk("stdout", data);
+            stdout = appendOutput("stdout", stdout, data);
+            if (outputTruncated)
+                refreshRetainedOutputs();
             stopForOutputLimit();
             rearmIdleGrace?.();
         });
         child.stderr?.on("data", (data) => {
-            stderr = appendOutput(stderr, data);
+            matchStreamingChunk("stderr", data);
+            stderr = appendOutput("stderr", stderr, data);
+            if (outputTruncated)
+                refreshRetainedOutputs();
             stopForOutputLimit();
             rearmIdleGrace?.();
         });
@@ -1415,7 +1561,11 @@ export async function safeSpawnAsync(command, args, options) {
             resolved = true;
             await waitForPipeIdle();
             const resourceUsage = finishResourceUsage();
-            const outputInfo = outputTruncated ? { outputTruncated: true } : {};
+            const outputInfo = {
+                ...(outputTruncated ? { outputTruncated: true } : {}),
+                ...(killedForOutputCap ? { killedForOutputCap: true } : {}),
+            };
+            const streamingMatchInfo = streamingMatch ? { streamingMatch: true } : {};
             // #1816: surface the signal name as a field on every path where one
             // exists, so callers can NAME it instead of scraping `error.message`.
             const signalInfo = signal ? { signal } : {};
@@ -1440,6 +1590,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...(timeoutTeardown && { timeoutTeardown }),
                     spawnFailure: new SpawnFailureError("timeout", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1454,6 +1605,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...signalInfo,
                     spawnFailure: new SpawnFailureError("killed", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1468,6 +1620,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...signalInfo,
                     spawnFailure: new SpawnFailureError("killed", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1497,11 +1650,19 @@ export async function safeSpawnAsync(command, args, options) {
                     failure: "spawn",
                     spawnFailure,
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
             else {
-                resolve({ stdout, stderr, status: code, ...outputInfo, resourceUsage });
+                resolve({
+                    stdout,
+                    stderr,
+                    status: code,
+                    ...outputInfo,
+                    ...streamingMatchInfo,
+                    resourceUsage,
+                });
             }
         };
         child.on("exit", onChildSettle);
@@ -1545,6 +1706,8 @@ export async function safeSpawnAsync(command, args, options) {
                 failure,
                 spawnFailure,
                 ...(outputTruncated ? { outputTruncated: true } : {}),
+                ...(killedForOutputCap ? { killedForOutputCap: true } : {}),
+                ...(streamingMatch ? { streamingMatch: true } : {}),
                 resourceUsage,
             });
             if (controlFailure)

package/dist/clients/sanitize.js

@@ -6,8 +6,14 @@
  */
 // --- Constants ---
 // ANSI escape codes for colors and formatting
+// oxlint-disable-next-line no-control-regex -- ESC (\x1b) is the literal ANSI escape-sequence lead byte this pattern strips, not accidental input.
 const ANSI_ESCAPE = /\x1b\[[0-9;]*m/g;
-const ANSI_ESCAPE_EXTENDED = /\x1b\[[0-9;]*[A-Za-z]/g;
+// Full ECMA-48 CSI grammar (parameter bytes 0-9;? , intermediate bytes
+// space-/, final byte @-~) — matches every CSI sequence ANSI_ESCAPE does
+// plus non-SGR ones (cursor moves, private-mode `?` sequences like
+// `\x1b[?25l`, etc.), not just the `m`-terminated color codes.
+// oxlint-disable-next-line no-control-regex -- ESC (\x1b) is the literal ANSI escape-sequence lead byte this pattern strips, not accidental input.
+const ANSI_ESCAPE_EXTENDED = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
 // Common error patterns from different tools
 const ERROR_INDICATORS = [
     /\berror\b/i,

package/dist/clients/scratch-tree-policy.js

@@ -54,6 +54,7 @@
  *     fully in scope.
  */
 import { EXCLUDED_DIRS, getExcludedDirGlobs } from "./file-utils.js";
+import { escapeRegExp } from "./string-utils.js";
 /** Directory-name entries only — drops glob entries (e.g. `*.dSYM`) that a
  * bare directory-name/regex exclude can't express. */
 function literalExcludedDirNames() {
@@ -68,9 +69,6 @@ function literalExcludedDirNames() {
 export function getScratchTreeGlobPatterns() {
     return getExcludedDirGlobs();
 }
-function escapeRegExp(literal) {
-    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 /** Bare directory names, for tools (opengrep/semgrep `--exclude`) that treat a
  * slash-free pattern as "this directory name, anywhere in the tree". */
 export function getScratchTreeDirNames() {

package/dist/clients/security-scan-client.js

@@ -16,6 +16,9 @@ import * as path from "node:path";
 import { createSubsystemLogger } from "./extension-log.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { classifyProbeFailure, createAvailabilityLatch, describeInstallAttempt, describeProbeEvidence, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
+import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
+import { createSingleFlight } from "./single-flight.js";
+const securityProbeFlights = createAvailabilityProbeFlight();
 export class SecurityScanClient {
     toolName;
     /**
@@ -68,6 +71,7 @@ export class SecurityScanClient {
     logDurableAbsence(evidence, elapsedMs = 0) {
         logAvailabilityDecision({
             tool: this.toolName,
+            producer: "security-scan",
             verdict: "unavailable",
             outcome: "missing",
             cause: "not-found",
@@ -79,7 +83,8 @@ export class SecurityScanClient {
     }
     /** Outcome of the most recent `probeVersion` call. */
     lastProbeOutcome = null;
-    ensureInFlight = null;
+    /** Availability resolution is instance-owned; only its external probe is shared. */
+    ensureFlight = createSingleFlight();
     inFlight = new Map();
     binaryPath = null;
     log;
@@ -99,15 +104,7 @@ export class SecurityScanClient {
     async ensureAvailable() {
         if (this.available !== null)
             return this.available;
-        if (this.ensureInFlight)
-            return this.ensureInFlight;
-        this.ensureInFlight = this.doEnsureAvailable();
-        try {
-            return await this.ensureInFlight;
-        }
-        finally {
-            this.ensureInFlight = null;
-        }
+        return this.ensureFlight.run("availability", () => this.doEnsureAvailable());
     }
     /**
      * Spawn `toolName <versionArgs>` and report whether it answered cleanly.
@@ -128,10 +125,26 @@ export class SecurityScanClient {
         const startedAt = Date.now();
         let probe;
         let hostStallMs;
+        let resolvedBinaryPath = null;
+        let probeJoined = false;
         try {
-            probe = await safeSpawnAsync(this.toolName, versionArgs, {
-                timeout: 5000,
+            const shared = securityProbeFlights.run(`security:${this.toolName}|${versionArgs.join("|")}`, async () => {
+                const { findManagedToolBinary } = await import("./installer/index.js");
+                const managed = await findManagedToolBinary(this.toolName);
+                return {
+                    probe: await safeSpawnAsync(managed ?? this.toolName, versionArgs, {
+                        timeout: 5000,
+                    }),
+                    binaryPath: managed ?? null,
+                };
             });
+            probeJoined = shared.joined;
+            const flightResult = await shared.promise;
+            probe = flightResult.probe;
+            resolvedBinaryPath = flightResult.binaryPath;
+            if (!probe.error && probe.status === 0 && flightResult.binaryPath) {
+                this.binaryPath = flightResult.binaryPath;
+            }
         }
         finally {
             hostStallMs = sampler.stop();
@@ -142,6 +155,7 @@ export class SecurityScanClient {
             this.log(`${this.toolName} found: ${probe.stdout.trim().split("\n")[0]}`);
             logAvailabilityDecision({
                 tool: this.toolName,
+                producer: "security-scan",
                 verdict: "available",
                 outcome: "success",
                 cause: "ok",
@@ -149,8 +163,14 @@ export class SecurityScanClient {
                 latched: true,
                 hostStallMs,
                 budgetMs: 5000,
-                classifiedBy: "probe",
-                evidence: describeProbeEvidence(probe),
+                classifiedBy: probeJoined ? "joined" : "probe",
+                evidence: {
+                    ...describeProbeEvidence(probe),
+                    ...(resolvedBinaryPath && {
+                        binary: path.basename(resolvedBinaryPath),
+                        source: "managed-dir",
+                    }),
+                },
             });
             return true;
         }
@@ -167,6 +187,7 @@ export class SecurityScanClient {
             : 0;
         logAvailabilityDecision({
             tool: this.toolName,
+            producer: "security-scan",
             verdict: "unavailable",
             outcome,
             cause,
@@ -175,8 +196,14 @@ export class SecurityScanClient {
             hostStallMs,
             ...(retryAfterMs > 0 && { retryAfterMs }),
             budgetMs: 5000,
-            classifiedBy: "probe",
-            evidence,
+            classifiedBy: probeJoined ? "joined" : "probe",
+            evidence: {
+                ...evidence,
+                ...(resolvedBinaryPath && {
+                    binary: path.basename(resolvedBinaryPath),
+                    source: "managed-dir",
+                }),
+            },
         });
         return false;
     }
@@ -311,7 +338,14 @@ export class SecurityScanClient {
             this.log(`Scan already in flight for ${key}; sharing result`);
             return existing;
         }
-        const promise = run().finally(() => this.inFlight.delete(key));
+        // Identity-guarded release (#1968's pattern): delete only if THIS run is
+        // still the registered one. A bare delete-by-key lets a late-settling run
+        // evict a live successor a second writer registered under the same key
+        // mid-flight, after which the next caller starts a duplicate scan.
+        const promise = run().finally(() => {
+            if (this.inFlight.get(key) === promise)
+                this.inFlight.delete(key);
+        });
         this.inFlight.set(key, promise);
         return promise;
     }